You can login to a remote Linux server without entering password in 3 simple steps using ssky-keygen and ssh-copy-id as explained in this article. ssh-keygen creates the public and private keys. ssh-copy-id copies the local-host’s public key to the remote-host’s authorized_keys file. ssh-copy-id also assigns proper permission to the remote-host’s home, ~/.ssh, and ~/.ssh/authorized_keys.
This article also explains 3 minor annoyances of using ssh-copy-id and how to use ssh-copy-id along with ssh-agent.

Step 1: Create public and private keys using ssh-key-gen on local-host

Step 2: Copy the public key to remote-host using ssh-copy-id

jsmith@local-host$ ssh-copy-id -i ~/.ssh/id_rsa.pub remote-host
jsmith@remote-host's password:
Now try logging into the machine, with "ssh 'remote-host'", and check in:
.ssh/authorized_keys
to make sure we haven't added extra keys that you weren't expecting.

Note: ssh-copy-id appends the keys to the remote-host’s .ssh/authorized_key.

Step 3: Login to remote-host without entering the password

jsmith@local-host$ ssh remote-host
Last login: Sun Nov 16 17:22:33 2008 from 192.168.1.2
[Note: SSH did not ask for password.]
jsmith@remote-host$ [Note: You are on remote-host here]

The above 3 simple steps should get the job done in most cases.
We also discussed earlier in detail about performing SSH and SCP from openSSH to openSSH without entering password.
If you are using SSH2, we discussed earlier about performing SSH and SCP without password from SSH2 to SSH2 , from OpenSSH to SSH2 and from SSH2 to OpenSSH.

Using ssh-copy-id along with the ssh-add/ssh-agent

When no value is passed for the option -i and If ~/.ssh/identity.pub is not available, ssh-copy-id will display the following error message.

If you have loaded keys to the ssh-agent using the ssh-add, then ssh-copy-id will get the keys from the ssh-agent to copy to the remote-host. i.e, it copies the keys provided by ssh-add -L command to the remote-host, when you don’t pass option -i to the ssh-copy-id.

Three Minor Annoyances of ssh-copy-id

Following are few minor annoyances of the ssh-copy-id.

Default public key: ssh-copy-id uses ~/.ssh/identity.pub as the default public key file (i.e when no value is passed to option -i). Instead, I wish it uses id_dsa.pub, or id_rsa.pub, or identity.pub as default keys. i.e If any one of them exist, it should copy that to the remote-host. If two or three of them exist, it should copy identity.pub as default.

The agent has no identities: When the ssh-agent is running and the ssh-add -L returns “The agent has no identities” (i.e no keys are added to the ssh-agent), the ssh-copy-id will still copy the message “The agent has no identities” to the remote-host’s authorized_keys entry.

Duplicate entry in authorized_keys: I wish ssh-copy-id validates duplicate entry on the remote-host’s authorized_keys. If you execute ssh-copy-id multiple times on the local-host, it will keep appending the same key on the remote-host’s authorized_keys file without checking for duplicates. Even with duplicate entries everything works as expected. But, I would like to have my authorized_keys file clutter free.

If you like this article, please bookmark it on Delicious and Stumble it.

@Sathiya,
Yeah, lot of people overlook ssh-copy-id, as you can still copy the keys manually.@mk_michael,
I believe you are talking about the keychain tool that is mentioned in gentoo.org. I have not used this before. Thanks for bringing this to our attention. I’ll check it out.@Jadu Saikia,
Thanks for your comments. I appreciate it.@domainnameyahoo,
You may want to run the ssh in debug mode to identify what could be the problem. Please refer to section 4 in the 5 Basic Linux SSH Client Commands on how to debug ssh client connection.

Geeks,
If ssh-copy-id command not found on your system please use the following method.
#scp ~/.ssh/id_rsa.pub user@remotehost:/home/user/
This will ask you the password of the user you have mentioned
#cat id_rsa.pub >> /home/user/.ssh/authorized_keys

when i tried ssh-copy-id ~/.ssh/id_rsa.pub jaliu@beeeater. i.e user@remote-host. i got an error; ssh: Could not resolve hostname /home/bayeni/.ssh/id_rsa.pub: Name or service not known. please what do i do

@Anonymous
You won’t be able to add your public key on a server where you don’t have a valid login/password combination.

And just to add my own geek stuff :
To get a password-less connection from local user1 to remote user2, copy the user1 public key(id_rsa.pub) to the remote user2 “authorized_keys” file using a pipe over ssh:

Neat. This was easy to set up on one of my computers. On the other one, it was a bit more stubborn. For the benefit of someone else who’s bit by it, sshd will not accept an authorized_keys file if either directory ~/.ssh or ~ are writable by Group or Others. The difficult system was PCBSD, in which every user also has their own group and their directory is writable to that group.

DO NOT FOLLOW THIS RECIPE NAIVELY – it is very dangerous, since a key with no passphrase is the moral equivalent of dumping your password in a file in the clear. Anyone who gets even momentary access to your private key TOTALLY OWNS any accounts where you’ve installed the public part.

The only way you should use an unencrypted key (no passphrase) is if you can guarantee total and eternal security of the private part. This might be possible, but is highly unlikely. That said, there are just two responsible ways to use keys:
– encrypt the key by providing a passphrase when you generate it. this may seem strange, since to use it, you’ll need to provide the passphrase, which is presumably harder than a password. and *that* is why ssh-agent exists: it lets you supply the passphrase once, not every time. (you can have ssh-agent timeout the passphrase after a fixed time, or keep it as long as its running.)
- constrain the key wherever it’s installed, so that it can only perform some limited function. for instance, if the key’s purpose is to permit something unattended like a backup, use openssh’s “command=” syntax so that the key can only be used for that, not to get a shell or tunnel through firewalls. (“man sshd” to see the syntax for the .authorized_keys file – constraining a key to particular client machines is also a good idea, etc.)

There’s a step still missing. I’ve done all the steps and I’m still prompted to enter a password… I believe there is a KEON change that needs to happen as well. Also, the public key is using the short name for the host, but you need to use the full qualified name to ssh, scp, or sftp. So,… how do we get the ssh-keygen to allow for use to type in a server name….

The tutorial works for me if I do it as root but that creates a security hole. When a create a user ‘user_ssh’ and follow the intructions, it seems to work but when I do
an ‘ssh hostname’ it asks me for:
Enter passphrase for key ‘/home/user_rsync/.ssh/id_rsa’:

Why does it not work ad a regular user?

Update: OK I got it to work by adding quotes on the “ssh” statement. See my cron below:
———————
#!/bin/sh

One thing that worries me now is that before when the user was root the report creared only show and overall of totals when no files were transfered but now that I am doing the rsync as a regular user the email I get has a list of all the files even if no files were transfer. I hope some one is reading this…………..

Please do note Patrick’s comment:
“sshd will NOT ACCEPT an authorized_keys file if either directory ~/.ssh or ~ are writable by Group or Others”
SSH would still ask for a password.
This solved my problem.
Remove a user from a group:
‘sudo gpasswd -d user-to-remove group’

I can make this work by typing the command into terminal, and by running the shell script it is inside, but it will not run through the remote control I’m using (to keep a media center mythtv backend from shutting down by sending a lock command) It lists a failed password

If you have a lot of hosts to update the authorized_keys, you may try the below
Add the below line to your .cshrc file (this works only with csh/tcsh)
alias sshcpid “cat ~/.ssh/id_rsa.pub | ssh \!:1 ‘umask 077; mkdir -p .ssh; cat >> .ssh/authorized_keys’”
Source the .cshrc before you can execute the alias
>source ~/.cshrc
Execute the alias by passing the username & hostname as parameters
>sshcpid user@hostname

Interesting. I followed the steps from Step 2 on (I already have a key generated, which has a passphrase attached). When I tried to ssh in as my user, I’m still prompted for a password. But, if I try to ssh in as root, I’m prompted for my passphrase (the first time after a reboot) and it logs me in automatically.

I’m going from an Ubuntu 13.04 machine to a Fedora 19 machine. The other interesting thing is, I have a customized .bashrc file on both the user and root profiles. When I ssh in as the user, I have to run source .bashrc to get it working, but when I log in as root, it does it automatically.

Could it be that I’ve never logged in on the remote machine physically as the user by chance? (It’s a home server running Amahi Home Server)

Have a great day.:)
Patrick.

—
In addition to my above comment, I also copied it to my mythbuntu machine, and it works perfectly. I’m thinking that it might be because the password isn’t the same on the server (for my user).

Hi Ramesh.. can you pls help regarding how to copy the file from one server to another sverver using scp command with password. i am using scp command to copy the file from one to another. that scripts works fine.so if we run that script via crontab then it fails.problem is password .it is not taking that password while run the cronjob.
debug1: Trying private key: /home/postgres/.ssh/id_dsa

This is a private system. Do not attempt to login unless you are an authorised
user. Any authorised or unauthorised access and use may be monitored and can
result in criminal or civil prosecution under applicable law.

About The Geek Stuff

My name is Ramesh Natarajan. I will be posting instruction guides, how-to, troubleshooting tips and tricks on Linux, database, hardware, security and web. My focus is to write articles that will either teach you or help you resolve a problem. Read more about Ramesh Natarajan and the blog.